Name: Cyber Security for Operational Technology Environments
Uploaded: 2026-10-22T12:01:13.857Z
Duration: 29 min 32 s
Description: Cyber Security for Operational Technology Environments

Transcript for "Cyber Security for Operational Technology Environments": Hello. Welcome to this webinar. My name is, Hakon Olsen working with Tufreinland. I've been invited to talk about cybersecurity for operational technology environments in this, ServiceNow Armis and Tufreinland organized webinar. I cannot see you in the in the webinar, but if... It would be nice if everyone, could say hello in the in the chat. And and, you could also please, state if you're working in OT or in IT, what kind of role you have. I think it would be nice for everybody to see if you're comfortable with doing that. So, what we're going to be looking at today is a very high level, overview of OT security. So if you're coming from the IT side, this may be quite new. If you're from the OT side, it's probably more, familiar topics. My own background, I've been doing cybersecurity for industrial systems for a quite long time. Originally, I'm a chemical engineer, but been doing cybersecurity since at least 2010. So it's it's been a while. So what we're going to talk about is is is the OT world today. Operational technology used to be the control system connected directly into the physical processes and being air gapped from the IT world, from the Internet. That's not really the case anymore, as we know. IT, OT convergence has been a term that people have discussed for a long time, and now it's, it's happening. It's very common that we are connecting control systems to cloud solutions today and do AI analytics to to do remote support and things like this. So there's really no air gap anymore. We have a lot more connections. That means also more paths into operations. So we have achieved huge productivity and optimization benefits from doing this. But at the same time, we have increased the complexity of our OT networks, and we have also increased the attack surface quite a lot. So this exposure to cyberattacks is a lot higher now than it used to be. So... And and for those who may not have an an OT background, OT is really digital technology today that connects to physical processes and physical equipment. So as an as an example, it's a typical control loop has a sensor that measures something in the physical world. It can be pressure, temperature, speed, something like that, And sends that signal off to a computing unit, which would be a controller, a PLC, real time type device that makes a decision on what to do in the physical world and will act through things like turning on and off a pump or closing a valve or increasing, the fuel into an engine, something like that. And that's quite different from from the IT systems. When such a system gets hacked, the consequences are physical. Right? They... It can cause, downtime so that production stops, but it could also lead to, accidents, release of toxic gases, fires, and very serious physical consequences. So so where we... In the the IT world, we are trying to protect the confidentiality of the data as the main priority that may be a bit different in the, in the OT world. Hi. Hakan. Sorry. I'm just joining, Hakan from Armis. So I run the the presales. We... Hakan and I were discussing this earlier. I think this was the this was the point we were gonna talk about, the type of nature of data that's... We're gonna protect. Yeah. So, I worked for for Armis ServiceNow, and I worked with... In the OT space as well for many years, and prior to that in the IT space. And in the I... If you... I'm sure many of you are familiar with the CISSP. Certainly, the, the CIA, model, typically, You know, information... Where information protection is really the key. So retailers, banks, really need to protect the customer data, and a lot of the multilayered security are built for that. But in the OT logistics engineering world, it's... Really the prioritization is safety first, as I'm sure, well, certainly OT practitioners know, and then uptime of the production lines, first. So it really changes to an AI, AIC model, from those of you that are used to doing CISSP thinking. And, certainly, organizations I speak to have said they will have necessarily a single loss expectancy calculation for the uptime, so for the accessibility, a, of their, production lines, and they'll know that down to the minute or second if it's, chemical production, or postal delivery. Often, that isn't the case in the IT organizations where it might be a five nines or four nines uptime around a website. That's the closest they're likely to have to some kind of metric, but it's a different world. And this is... Understanding this is critical to how we apply cyber defense. Any cyber defense scanning, etcetera, that is applied that breaks that is of no use. We know that. So I just wanted to add that in. Thanks, Achin. Yeah. Thanks, Anthony. So I I think we can stay on that topic It's it's the reason why availability and integrity are typically more important than than confidentiality in the systems is is really from the consequences you can have if these systems fail. So if you think about an old g systems that is being hacked by an external threat actor, you know, one thing that you worry about is loss of visibility. Right? So if the screen becomes black, it gets hard to use, use your process data to make the sessions. But also, if you cannot trust the data that you see, if it is reporting a certain speed on a motor or if it's reporting a certain temperature, on a heating device, if you cannot trust those readings, your operational decision making will be wrong. And you can then lose the ability to control the plant. So so if you can't really keep the process within the design limits of of the plant, this may become very dangerous, of course. So so you can have a gas leaks, lower pressure, you can have fires, and things like this. And then, you will end up with a production impact. And then, potentially, you could also have, destruction of the, of the production equipment itself and injuries of the people working there, potentially loss of life, and and also ecological impact if you have a lot of pollution coming from that. So so so the consequence side of of a cyber attack on all key can be very, very serious. And now the question is, how can an attacker achieve such consequences? Right? So so I want to to look, a little bit of that with a simple example. So if you come from a process engineering point of view, the question how can an attacker cause physical impact is quite important. So so so what we're looking at here is a is a typical pressure vessel. It's a steel container containing, fluids. It can be liquids and gas, and, that's a very common type of unit operation in a chemical plant, for example, or in oil and gas plant. So where you try to maintain the the pressure at a constant level or at the set point level using, a controller that's opening and closing a valve on the gas outlet. At the same time, you're trying to keep the liquid level within, the levels you wanted by opening and closing the liquid outlet valve automatically using the sensors and and computing devices. So from a hacker's point of view, if they want to attack this and cause an accident, it typically starts in the IT domain. And then the attacker tries to take control of the user accounts and computers, the typical IT hacking risks, and then they try to move from there and into the OT network. And, typically, this takes a lot of time and expertise to understand and plan and execute such an attack. But that is being challenged now by AI because it is, giving new capabilities to people who did not have that type of expertise before, and and it also shrinking the time it takes from the initial compromise until they're able to execute the actions with physical effect. So so if you look at that in a bit more detail for this type of pressure vessel, I'm going to show an example of... That that would be quite familiar to people in process engineering, maybe not in IT. So a pressure vessel like this has designed for certain process safety cases. So so you're looking at the risks, what could happen. One such risk is typically overpressure that could lead to leaks and dangerous situations. And then you have standards, design standards for what kind of safety equipment should you have in place to stop that from happening. So sort of the first line of defense is your control system trying to maintain the pressure at the at the set point. And then the next one is what is in this, matrix on the left hand side here called PAHH. It's called pressure alarm high high. It's an automated trip that will close the inlet valve if you get a high pressure in here. So there's a separate control loop from the one trying to maintain the pressure. And then finally, you have a mechanical device called the pressure safety valve or pressure relief valve, which is a spring loaded valve, entirely mechanical, no IT, no networking, and so on. So it should be quite safe from hacking. It's sort of a... If all else fails, this is going to lift if the pressure gets too high to protect you from overpressure. So if an attacker wants to, from the outside, reach the system and be able to manipulate it so that maybe you will have an accident or at least you will have some downtime, It used to be the common thinking that this isn't really possible because it's it's, segregated. It's air gapped. But today, there are firewalls, but but they are connected together. And, then there is a way to to get into the system, and this, happens quite often. But, unfortunately, we don't see a lot of accidents occurring because of it. So if you take the same view from a more, a networking, perspective, yeah, you typically have here, the typical IT world where we work in our offices. We connect to the Internet and so on. Between, that world and the OT world, you will typically have, first, an IT firewall, then a industrial DMC, demilitarized zone, where you have some of these integration services. You have a jump server to reach the OT system. You have data historians, maybe as antivirus services and so on. And another firewall before you reach the actual OT networks. So if you have an attacker here that typically starts like it always does. Right? So they say can be... They exploit some vulnerability, and maybe they send a phishing email to the maintenance manager, perhaps. So they have done some, recon, found out this person probably has a lot of access. You send that phishing email, and you managed to install some malware on the, office computer of that person so you can remotely control it from the cloud. Maybe you have a c two server in operating from Microsoft Azure or some other cloud service. And then from this computer here, you find a vulnerability in the IT firewall that you can compromise or you find some way to get through that firewall and and reach the jump server. The jump server is where you would log in with OT credentials and try to... Or you should be able to reach things within the process network. And, something that can happen is is that they will use the data historian as a sort of an internal proxy because that historian is getting data from the OT world and serving it through to the IT side and maybe to the cloud. So it's supposed to be able to communicate both with the OT side and the IT side. So because of that, it's often a good point for the attacker to try to get control and data outside to the Internet again. So if you have an attacker that has achieved this, they now have the starting point for reaching the OT network, and they have, and they have a remote control over the jump server. So so this is a a bad position for us if we're trying to defend the network. We should be able to detect and stop that from happening. But but, sometimes, we're we're not that good at defending. Right? So, so if they wanna move into the OT domain, that's when it really starts to get, dangerous. So if you look at the typical time line here, maybe that phishing incident happens on a Monday morning, and you install malware and do the lateral movement throughout Monday morning. And then, in the afternoon, maybe on that jump post, everybody who is connecting in and and moving into the OT network will go through that jump post. So if you're able to hijack a remote access session through that one, you can get into the network. So if the attacker is then waiting for the safety engineer to log on and to do some work on the safety system, if they manage to hijack that session, they can change the safety parameters and maybe change the, pressure alarm high high set point to something very high. So it effectively doesn't work anymore, then you you don't really have that safety barrier anymore. And then after that, if they're unable to exploit more vulnerabilities or some find some other way to get into the actual OT network and get control there, they can manipulate the valves, lock the outlet. And then, if you you do this in, when the PSV is in a degraded position, they could potentially cause an actual accident that could be a toxic gas release. It could be a flammable gas that is igniting because of some ignition sources outside. So it's this type of physical consequences that we're really trying to defend against. And traditional process safety isn't really taking that into account. So when we include cyberattacks and risk assessments, we need to change a few of our assumptions. Right? And, typically, assumption about simultaneous events is very important in process safety. You you wouldn't really think that the PSV would fail at the same time as, you have a blocked outlet, for example. But when you have a threat actor who's trying to make the accident happen, that assumption is no longer valid. But, luckily, most security incidents do not lead to safety incidents, but they do threaten production uptime. So downtime from cyber incidents is not that unusual. And these constraints, especially the the safety constraints that we've been talking about, is very important for the security architecture in the OT world. So the point of reference for most, OT security design today is, the international standard, IEC six two four four three. Important concept inside of that standard is the concept of zones and conduits and security levels, where you group, equipment into zones for equipment that needs to work together and communicate internally. And they use risk assessments to apply security levels to those zones and to the conduits, which are the communication paths between zones. The risk assessments are, very important for this, but they're typically done during the design of the plant or during major changes. But we live in a world where the external threat landscape is rapidly changing. So with changes in the threat environment, we should regularly reassess that risk exposure for the zones to make the security controls and the operating practices suitable for the world we actually operate in. And this is very important as the lifetime of the OT networks can be very long. So if you design something and operate it for thirty years, there's been a lot of developments in cybersecurity and cyberattacks over the last thirty years. So if you did this in the beginning of the two thousands, your risk assessment is probably no longer valid. So when it comes to the security levels, so the the implication of that is it directs what kind of security controls you should implement to protect the zone and the conduit and the network. And, those security controls have different constraints from what we see in security controls in IT. So if you come from an IT world and move into OT, you may easily feel that the security controls are very, say, rudimentary or maybe a bit old fashioned. And that is true. There's a lot of the capabilities that we have in the IT world that really don't exist in OT. So IT security controls are often highly automated and they're efficient for information technology. But for operational technology, where we have these auto constraints, we tend to be slower and have more deliberate considerations around controls and the changes in our environments. So where you typically would use regular scans to keep control of your assets under security posture in the IT world, in the OT world, this is typically not acceptable, and you're down to passive network monitoring and manual procedures for keeping track of things. The typical security approach has been, until, recently, to patch very quickly. Today, that is even becoming very challenging if you have more manual processes in IT because of all of the vulnerabilities that are being discovered. But in OT, you really can't shut down and restart servers and things like this very often. So micro segmentation and targeted patch windows are more common, which maybe you're patching every three months instead of every week, basically. And, also, if you have incidents, it's different because in IT, you will typically have somebody in the SOC can isolate an endpoint very quickly by clicking a button in the plant. You can't really isolate that without thinking about the dependencies. You need to have an isolation plan based on the operational dependencies to make sure you don't create an even more dangerous situation. And I mean, if you take that one step further, one... On a typical response here, it would be to go into idle mode if you have serious security incident. Island mode is when you disconnect the OT network from the IT side. So you sort of recreate that air gap that people used to have in the old days. And that has been a good approach to protect, for example, the OT network if the IT network of a company is hit with ransomware. Then you disconnect at the firewall to make sure that that ransomware does not hit your factory. Problem is it can be quite difficult to do because you have a lot of operational dependencies because of that IT, OT convergence. So a lot of the decision making you need to do can depend on cloud services and and, maybe you need some remote support from your vendors and so on. So, actually, moving into an island mode operation can be much more difficult today than it used to be. So if you haven't planned around this and how to be working and for how long you can do that, it's going to be quite difficult. But it's still important and sometimes also a regulatory requirement that you're able to operate in island mode. So with this as a backdrop, and we look at, okay, what's the effect of AI on this? Because it's definitely affecting the OT world as well. So what we see is that AI provides us with many benefits. For example, decision support systems, data insight solutions, machine learning for machine maintenance, and so on. But at the same time, it's the amplifier of attacker capabilities. So So we talked about the security levels. The security level four is something that was thought of as the the defense you need to protect against nation state actors and very capable threat actors. For today, a lot of less capable actors are getting help from AI so they're able to execute much more complicated cyberattacks. So that model may not be that valid anymore. And, also, we see that the number of vulnerabilities that are being discovered, are increasing very rapidly. So so we're discovering a lot more vulnerabilities today every week than we did, like, a couple of years ago every week. And this is seen also in the OT bots. If you look at the the vendors of OT equipments on controllers, safety equipment, HMIs, control panels, things like this, you also have a lot more vulnerabilities in there. And what this really means is that the principles of good security architecture are becoming even more important because there's no way we can patch ourselves out of this, and especially not in OT where we cannot restart equipment whenever we want and so on because that uptime constraint is really important. I I guess, Anthony, you you mentioned this in in terms of, sort of the cost of the downtime per second or something, and that cost can be very high. So, say, if you you have a production plant that's down per day, maybe you lose €10,000,000. Yeah. That's, for most companies not, acceptable. Right? Yeah. Exactly. It's... What we all know and fully understand the challenge of any... All the things we take for granted, whether it's transport. Well, we we expect them to run on time. And, of course, we can't just go and pull a laptop like we could in, say, in a bank or retail, pull a laptop off of a network and, investigate it or just reimagine it. That's just, you know, that is not gonna happen in OT or medical environments. But just looking at... I mean, while we're talking about the AI, I agree amplifies a threat, and you and I, Hakam, we're talking about this earlier. The thing that we're seeing is the collapse of the the time window for the reconnaissance piece. Previously, you know, there there was an element of luck if if a a human bad actor found things quickly, you know, or they were just being diligent doing their research could take days, weeks, months. Sometimes you would find connected devices which had been connected for even years, and then no one had discovered them. I mean, that's poor hygiene, but still, they were not, they were not exploited. But now with the potential of armies of AI bots under, you know, the control of various actors, then the... You know, effectively creating, a very much lowering the bar really to to pen testing. The chances of devices being found which are accessible is much, is much more likely. K? And it's gonna happen much faster. And we're, you know, we're seeing that. You've seen all the news around the AI models where they're using them for testing rather than actually using them by bad actors. And we know that organizations have started deploy... Employing, in in some cases, hundreds or thousands of staff just to go and start trying to address the the holes. Now in IT, you can patch to a degree, but in OT, you you can't or rarely, can you? But you can still use the components of the IEC sixty four four three model when you look at your relevant security level you wanna go for. You look at how you organize the zones, understanding which devices are talking and which protocols across different zones and ensuring that you have secure by design implementation. The organizations... I think this will be the same as when backup technology first arrived in the early... In the late nineties and early two thousands. Everyone I met then who had a great backup, policy had a... Also a terrible tragic story of how they'd lost a whole load of data, because they learned their lesson the hard way. It'll probably be the case here for many OT organizations as well, but the ones who protect themselves are the ones who give themselves a chance to minimize the threats because it is the the collapse of time that is really the biggest threat now. Thanks, Hakan. Yeah. Thank you. And I I agree with the... With with that. That if you if you do the work and you you build a defendable architecture, you stand a much better chance of avoiding bad consequences. So I I think I wanna close this with sort of summarizing what you just said, Anthony, and that's, look at what what does good actually look like. Right? And a and a robust OT system, it it starts with good operational discipline. And the first first thing you really need is to know what assets you have and what what is the status of those assets. So you need to have an owner for every system, and and you need to know what the security posture and exposure of those assets are. So if you start there and if you if you have already solved that, then you're already in a quite good place. And and the next one is to keep control of your zones and conduits and the and the data that's allowed to flow between them. So you you really need to enforce control of data flows because, endpoint control is much more difficult within OT networks. And then management of change is where it often fails. Right? These networks, they live for a very long time. And if you if you do changes to them and you don't really manage the risk in that and you don't really update your documentation, then it feeds back into not knowing your assets. And finally, you can't really let the technology people on the IT and networking side make decisions without taking the operational constraints and operational constraints into into account. So you need... Really need the operations and and planned engineers to work very closely together with the, IT and cybersecurity engineers. So I I think I'll summarize it as that. And then if there are any questions, feel free to use the chat box to ask. And if not, thank you for your time. I hope it's been a a good session. See if we get any questions. It's probably. Doesn't. look like it. Probably long enough. Yeah. Oh, I guess we'll close down. Yep. Alright. Have a good day, and then, hope to see you next time in our next webinar. Thanks,. Alright. Bye bye now.